Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ten years of JSON Web Token and preparing for the future

self-issued.info

Post reply on HN
Print view View original

1–10 of 159 posts

Re: Ten years of JSON Web Token and preparing for the future

#4

Post by vrosas »

90s_dev wrote: post #2

> It’s often said that one sign of a standard having succeeded is that it’s used for things that the inventors never imagined. It's certainly a sign of something's utility and versatility, for sure. Congrats.

If you go back and search hacker news for any article involving JWTs or OAuth you’ll find hundreds of comments of circular arguments over what a JWT is and is not. People never seem to be able to separate the two.

Re: Ten years of JSON Web Token and preparing for the future

#7

Post by 90s_dev »

vrosas wrote: post #4
90s_dev wrote: post #2

> It’s often said that one sign of a standard having succeeded is that it’s used for things that the inventors never imagined. It's certainly a sign of something's utility and versatility, for sure. Congrats.

If you go back and search hacker news for any article involving JWTs or OAuth you’ll find hundreds of comments of circular arguments over what a JWT is and is not. People never seem to be able to separate the two.

I still don't really understand them. The last time I used them was for a client probably in 2016 or 2018, and I forgot everything I learned about them. But they have an RFC so that's pretty cool.

Re: Ten years of JSON Web Token and preparing for the future

#9

Post by slt2021 »

genghisjahn wrote: post #6

I love JWTs between servers. Between servers and clients, you just end up remaking cookies/sessions. Strictly my experience/opinion. Glad to hear from others.

you cant generally reuse cookies across domains, because browser controls which domain receive which cookie. Also cookies are not cryptographically signed and thus easily forgeable by the client/browser.

JWTs on the other hand allow to be used across domain, so that you can use JWT issued by your IDP on one domain, to be trusted on another domain. crypto signature helps in verifying integrity of data.

sessions are usually tied to a single backend/application server. Its hard to reuse a session data across different apps.

JWTs on the other hand allow sharing session data across different app servers/microservices.

Re: Ten years of JSON Web Token and preparing for the future

#10

Post by gerdesj »

genghisjahn wrote: post #6

I love JWTs between servers. Between servers and clients, you just end up remaking cookies/sessions. Strictly my experience/opinion. Glad to hear from others.

Cookies are only controlled by the server but obviously can be negotiated for with a secret. JWTs have a mutual secret component built in and far cooler sounding ... stuff. So both ends have to trust the other and prove it with JWT and when cookies are in play, you takes your chances - you can use mutual TLS to get the same trust that JWT gives.

I have a web app that I'm doing sysops for which ended up with both. The web devs insisted on JWT and cough "forgot" about the auth bearer bit in the header because their API didn't use it. I ended up amending and recompiling an Apache module for that but to be fair, they will support it in the next version so I can revert my changes. A few db lookups in the Apache proxy JWT module I'm using and you have your claims.

On the front of that lot you have Apache session cookies generated when auth succeeds against a PrivacyIDEA instance - ie MFA.

I suppose we have cookies for authN and JWT for authZ. Cookies could do both and apart from session I'm not too familiar but it looks like claims would require multiple cookies where JWT does it all in one.

Post reply on HN